CONCERNS THE BOCS SHOULD HAVE WITH A PROPOSAL TO 
HAVE A CONTRACTOR LEAD OR REPLACE THE 
INDEPENDENT IN-HOUSE AUDIT SERVICES DEPARTMENT 



I. Introduction 

During the September 25, 2012 meeting of the Board of County Supervisors, the agenda 
was amended at the Chairman's request to obtain the Board's approval of his proposal to 
have the County Executive and County Attorney provide assistance to the contractor, 
hired to perform a few audits to supplement the work of the in-house internal audit 
function, in developing a proposal to lead or replace the existing in-house internal audit 
function. Although the Board voted to approve the resolution unanimously, the issue was 
inadequately considered and no staff study was written and presented to the Board for its 
use in evaluating the merits of such a change that would have far-reaching negative 
implications on the credibility of the work of the internal audit function and the County in 
the eyes of the taxpayers. 

Aside from the potentially inappropriate purchasing issues associated with accepting a 
single vendor's proposal to materially re- write the scope of work under the published 
Request for Proposal (RFP), the Audit Services Department has a professional obligation 
to advise the Board on audit matters and this document summarizes our primary concerns 
about the proposal to consider giving control of the internal audit function to an outside 
contractor. 



H. Background 

The Audit Services Department had requested funding in the FY2013 budget process to 
pay for a contractor that could provide needed information technology (IT) audit 
capability that requires IT specialty certification. Although the County Executive's 
Budget Congress approved half of the requested amount, after review by senior 
management the request was denied. 

Following the departure of the former Audit Services Director, and in line with our 
earlier request, senior management and the Board Audit Committee decided to develop 
an RFP to obtain the requested supplemental services of a contractor. The difference 
from our request was that the money used would come from salary savings from the 
vacant Audit Services Director position rather than from new funding. Following the 
subsequent attrition of two additional audit staff members, the salary savings from all 
three positions were taken from the Audit Services budget which accumulated into a sum 
of money far greater than the amount we had requested for hiring a contractor to perform 
a couple of specialty audits such as IT and possibly a major construction audit. 
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The net effect is that the six professional audit staff member positions authorized in the 
budget were effectively reduced by half. Despite the severe resource restrictions for the 
remainder of FY2012, the Audit Services Department completed, on time, all audits 
included in the FY2012 audit plan including an audit of a pension plan that identified 
costly, significant mismanagement. 

Given the effectiveness of the Audit Services Department over the past several years 
including significant resulting dollar savings for the County and the prospect of obtaining 
the services of a contractor to supplement our existing capabilities, we were optimistic 
that the Board Audit Committee's plan to obtain services from that contractor would be 
an effective use of taxpayer money. However, after a series of actions to alter those plans 
drastically, we strongly oppose a proposal to have a contractor lead or replace the 
independent in-house Audit Services Department. 

III. The Plan to Utilize a Contractor Deteriorated from Appropriate to 
Unacceptable 

The RFP published by the County to solicit proposals from CPA firms that had needed 
specialty audit capabilities was initially set up appropriately to address independence 
concerns. For example, the RFP, originally written by the Department of Finance, named 
the head of the Audit Services Department as the contract administrator and named the 
Audit Services Department as the reviewer and approver of the contractor's audit plans, 
reports, and other deliverables. These provisions, as established by the Department of 
Finance, were entirely appropriate for maintaining independence, i.e. the contractor 
would not be working for management-the contractor would be working for the 
independent internal audit function. For that reason the Audit Services Department, to 
this day, endorses that arrangement as initially developed by the Department of Finance. 

However, after a contractor was selected during the purchasing process, the contract that 
was presented to the BOCS for approval on July 24, 2012 reflected a change in the 
contract administrator designation from the head of the Audit Services Department to a 
yet-to-be-determined employee that we later found out was to be the Deputy Finance 
Director. Making this change in contract administrator is inappropriate because the 
Deputy Finance Director represents management which is always a responsible party 
(auditee) in any audit of County operations. The Department of Finance was aware of 
this conflict of interest when they named the Audit Services head as the contract 
administrator. With management now holding the purse strings, the contractor's loyalties 
are shifted to those in management who make payment decisions as well as contract 
renewal recommendations each year. 

As inappropriate as that change was, at least the contract with the outside firm that was 
approved by the BOCS still assigned critical review and approval responsibilities to the 
Audit Services Department which could have helped to address remaining independence 
concerns, i.e. the work of the contractor would still have to be done objectively without 
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undue influence by management or the Audit Services Department would be authorized 
to not approve the contractor's work products. 

During the Board Audit Committee meeting on September 25, 2012, after the Audit 
Services Department presented the results of its five audit reports completed in June 
2012, including the pension fund mismanagement findings, the Board Audit Committee 
decided to consider further changes that would remove all of the responsibilities of Audit 
Services that could have mitigated concerns about the independence of the contractor, by 
having the contractor lead or replace the Audit Services Department. To make such a 
change would completely eliminate the review and approval function of Audit Services 
and would have the contractor report to the Board Audit Committee and management; 
however, neither of those parties would be able to properly perform those functions. 
Specifically, management review would represent a clear conflict of interest and Board 
Audit Committee review would not be practical because of the lack of audit expertise on 
the Board Audit Committee and because the tasks would be much more time-consuming 
than the busy schedules of the Board Audit Committee members have ever allowed. The 
duties that should be performed by Audit Services were appropriately listed by the 
Department of Finance in the BOCS-approved contract with the outside firm as follows: 

The County (the Audit Services Department) has the oversight responsibility for 
each contracted internal audit assignment. These responsibilities include but are 
not limited to the following: 

a) Approving the audit objectives, scope, and methodology as prepared 
by the Contractor; 

b) Commenting, reviewing and approving engagement letters; 

c) Encumbering funds for the project; 

d) Notifying the Contractor to proceed with the assignment when funds 
have been encumbered; 

e) Conducting periodic progress meetings with the Contractor; 

f) Assigning additional work based on information obtained during the 
preliminary work; 

g) Acting as a mediator between the auditee and the Contractor; 

h) Reviewing the Contractor's draft audit report (or risk assessment or 
other engagement product) and providing comments on the draft to the 
Contractor prior to it being sent the auditee; 

i) Reviewing the final draft report and notifying the Contractor to 
finalize the audit report and to advise the Contractor of the number of 
final report copies; 

j) Approving the Contractor's invoice for payment. 

Despite the protections from independence concerns that these Audit Services 
responsibilities would have provided, management and the Board Audit Committee have 
proposed to eliminate these protections. 
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Also, despite the Chairman's stated intention to address independence concerns by 
having the contractor report to the Board Audit Committee, rather than to management, 
because the Board Audit Committee would not be in a position to realistically perform 
these tasks the work would then default to management, who, ironically, has guided the 
Board Audit Committee on audit issues for many months. In fact, management had total 
control over audit issues, at the exclusion of the Audit Services Department, as evidenced 
by the Board Audit Committee having closed session discussions without Audit Services 
at the Board Audit Committee meetings of February 21 and September 25. Management 
also set up a meeting with the Board Audit Committee without inviting the Audit 
Services Department, after Audit Services had been trying for months to get the Board 
Audit Committee to make a date available. In addition, without BOCS approval, 
management has, in effect, countermanded the BOCS-approved Audit Charter by 
directing department heads to stop dealing with the Audit Services Department on audit 
matters. 

The Audit Charter gives the Audit Services Department authority to conduct audits and 
requires County employees to provide Audit Services Department personnel with access 
to documents and personnel as requested and is within the purview of the BOCS and not 
management. Management control of the internal audit function, is a conflict of interest 
and is, therefore, not desirable. If that happens, the BOCS and the taxpayers will never 
be able to count on learning the truth about what may be going wrong in the County. The 
BOCS should not abdicate its responsibility to enforce its Audit Charter and should allow 
the Audit Services Department to be strengthened and to remain independent and fearless 
from management intimidation. The Board Audit Committee should understand the 
importance of working with the Audit Services Department on audit issues rather than 
management. The truly independent in-house Audit Services Department has worked in 
the best interest of the BOCS and the taxpayers and has always made an effort to 
maintain a working relationship with management. 

An understanding of the lack of independence is important for the BOCS members to 
have before they endorse a drastic change to weaken the same independent internal audit 
function that the Board Audit Committee strongly endorsed a few short years ago and 
that has produced findings and reports that have added value including some that resulted 
in significant dollar savings. For that reason, we have described below the importance of 
independence and the importance of institutional knowledge that would be lost if the 
Audit Services Department was replaced or controlled by an outside contractor. 

Professional Audit Standards Require Independence for a Reason 

According to the Institute of Internal Auditors, two concepts that are fundamental to the 
value of an internal audit function are independence and objectivity. Independence is an 
attribute of the audit function; whereas objectivity is an attribute of an individual auditor. 
The IIA defines independence as the ability to conduct internal audit activities without 
undue influence or control and individual auditors achieve objectivity when they have an 
impartial, unbiased attitude and avoid any conflict of interest. IIA standards require that 
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"the internal audit activity must be free from interference in determining the scope of 
internal auditing, performing work, and communicating results." 

Because the internal audit profession is built on the concept of independent assessment, if 
the assessment is not independent it is not credible. The lack of independence hurts 
credibility because taxpayers and others seeking accountability in their government will 
not know whether audit results reflect reality or reflect an altered version that is 
politically acceptable to management or others who are responsible for government 
operations and government policy. Without credibility, the value of internal audit to the 
County and to taxpayers would be significantly diminished. 

During the September 25 Board Audit Committee meeting the in-house internal audit 
staff presented the results of the completed FY2012 audits which included a pension fund 
audit which was anticipated to be of concern to the members. The members did not 
question the accuracy or completeness of the audit report. In addition, per usual 
procedures, the draft report had been reviewed by all relevant County personnel including 
management, with no unresolved objections. Rather than accepting the report and 
forwarding it to the BOCS, along with the four other reports presented at that meeting, 
the Committee opted to label the final, completed, signed report as "incomplete' in order 
to justify holding it. The report was not held back for just cause. The contractor 
accepted the Committee's assignment to see what they could do to help deal with the 
completed audit report. Although in some professions contractor cooperativeness and 
customer service are welcomed attributes, in internal auditing, the audit shop needs to 
perform independently without undue influence by others. Professional auditing 
standards state that the auditor must be sufficiently removed from political pressures to 
conduct audits and report findings, opinions, and conclusions without fear of reprisal. 

As evidence of a different kind of conflict of interest, the contractor has already been 
tasked with conducting a risk assessment and developing an audit plan which will be used 
to identify audit work to be performed. A consequence of tasking the contractor with this 
responsibility is that the contractor would be proposing their own work to be performed 
under the contract. Without proper oversight by the Audit Services Department, the 
contractor's proposed audits could be skewed to their highest profit margin type of work 
or skewed to accommodate their availability to perform the needed types of audits or that 
of their sub-contractor. The taxpayers and the BOCS could continually question whether 
audits are proposed by the contractor for reasons of highest risk or other valid criteria or 
whether they were chosen for self-serving reasons. 

Any declaration that County employees are less independent than a contractor would not 
be accurate, given the fact that the pay of employees is not impacted by management and 
the fact that the current in-house staff members have proven themselves to be 
independent because of their behavior in reporting with integrity and accuracy. Although 
it is our responsibility to provide our audit results to the BOCS through the Board Audit 
Committee, audit standards do not require us to publish our reports to the public and we 
do not do that. That does not mean that the BOCS does not have a responsibility to be 
transparent and accountable and to provide the reports to taxpayers. 
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Hopefully you can see that the contractor is not more independent than in-house internal 
auditors. 

Privatization would cause the loss of institutional knowledge 

As the Chairman appropriately stated at the July 24, 2012 BOCS meeting when the full 
board approved the contract with the external firm, "if you completely contract the entire 
function out then what you lose is the institutional knowledge of the organization." He 
went on to say that the County needs some internal auditors to be County employees but 
we also need the flexibility to bring in contract personnel that are needed at any given 
time for performing special work such as forensic IT audits. The Chairman indicated that 
these contract personnel, whose skills are needed from time to time, should not be hired 
permanently and that is the most efficient model that we should go forward with. Audit 
Services concurs with the Chairman's vision to supplement the Audit Services 
Department when necessary, which parallels our original request for contractor assistance 
in the FY2013 budget cycle. At the same meeting, the Deputy Finance Director stated 
that the hybrid approach will give you the most bang for your buck when you can get 
subject matter experts, such as IT experts, to come in with specific skills. 

About four years ago the internal audit function was updated by the BOCS to improve 
independence by moving it out from under the County Executive to a position reporting 
functionally to the BOCS through the Board Audit Committee. Prior to that change, the 
County's internal audit function had been in place for over two dozen years and 
successfully conducted a number of special investigations and operational audits resulting 
in the discovery of fraud and waste. The Board Audit Committee has appreciated the 
work done by the internal audit function regarding a number of significant issues 
including the Bluebird Bus replacement fund, OIT contracting, the Gainesville District 
Volunteer Fire Department management, and a multi-million dollar pension fund. 

Valuable institutional knowledge has been gained over the years by the in-house internal 
audit staff that should not be lost, including background on component organizations, 
culture, issues, shifts in responsibilities, priorities and policy guidance by the BOCS, 
obstacles facing departments, background and historical problems and fixes, operational 
protocols by different departments, and the status of ongoing challenges. The in-house 
audit staff members have established contacts and built relationships with many trusted 
County employees who have served as valuable points of contact for a variety of audit 
projects as well as for planning for future audit areas. These numerous and expanding 
personal connections have also been the source of important impromptu information on 
observed changes, successes, failures, and areas in need of attention. The ongoing 
insights into the control environment should be considered to be valuable by the Board 
Audit Committee and the BOCS and should not be discarded. To replace the in-house 
audit staff would be contrary to taxpayers' interest. 

The IIA reported the following passage regarding internal auditor independence: 
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"Because internal auditors are embedded within the company, they know its 
operations and risks from the inside. Yet it's the internal audit activity's 
independent reporting structure that grants unfettered access to an oversight body 
such as the audit committee, that empowers auditors to share their internal 
business knowledge freely - not just the good, but also the bad and the ugly." 

An outside contractor tasked with performing specific named, approved audits would not 
have the kind of ongoing relationships with County employees that address issues not 
currently under audit and that can yield valuable insights into the broader control 
environment in the County. A County that would want to look only at the areas under 
audit and ignore issues outside of those silos would appear to look the other way on a 
host of potential issues needing attention. That stance would give taxpayers the 
impression of a County's desire to not shed light on potentially embarrassing audit 
findings that could also look bad to regulators or rating agencies. 

Not only would the County be hurt by the loss of past and ongoing institutional 
knowledge of in-house audit personnel, but the County would also lose considerable 
audit experience. The current remaining three in-house professional audit staff members 
have a combined 56 years of auditing experience and over 24 years of local government 
auditing experience between them. They have 4 master's degrees and 5 certifications in 
accounting, fraud examination, and auditing including CPA, CIA, and CFE. All of the 
audit staff members are extensively trained in internal auditing and have completed 
numerous audit engagements for the department. Despite being short staffed, the internal 
audit staff completed all audits in the FY2012 audit plan on time. 

At a BOCS meeting on July 24, 2012 as the BOCS was considering the approval of a 
contract with an outside firm to provide supplemental audit resources for certain specialty 
areas such as IT auditing, the County Executive stated that "staff fully supports the 
internal audit department and its reporting relationship to the Board." She indicated that 
the internal audit staff performs a crucial function especially looking at internal controls. 
During the same meeting, Supervisor Jenkins got confirmation from the County 
Executive that the existing in-house audit team would be functionally managing the 
administration of the audits. The action by the BOCS on September 24 to direct the 
County Executive and County Attorney to assist the contractor in developing a proposal 
to lead or replace the Audit Services Department appears to be completely contrary to all 
of these positions of the members as stated at the BOCS meeting on July 24, without any 
justifiable reason for doing so. 

On a logistical note, the in-house internal audit staff is available every day whereas an out 
of town outside contractor having other clients and assignments may not be able to 
devote the same focus. This availability is particularly important in receiving and 
handling hotline-related calls and mailed or emailed reports of fraud, waste, and abuse. 
Availability can also be a factor in handling sensitive investigations that require a quick 
response. Interviews, meetings, acquisition of original documents for audits, etc. can be 
unnecessarily complicated when dealing with out-of-town contractors whose schedules 
dictate the time and place for those activities, whether convenient for all parties or not. 
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The four key contractor personnel as listed in the contract are based in North Carolina 
and Florida and the contractor will be using an affiliate based in Harrisonburg, Virginia 
to help meet the staffing needs for this contract. 



IV. Summary 

County taxpayers and voters understand that large organizations such as the Prince 
William County government will experience some problems and internal control failures 
among its many successful programs, activities, and processes; however, the public 
should be able to have confidence that there is a genuinely independent internal audit 
function that is charged with identifying whether problems exist and prompting 
management to correct those problems and take appropriate actions to provide reasonable 
assurance that the problems will not occur again. 

Based on a survey it commissioned, Ernst and Young reported that a co-sourcing 
arrangement whereby the in-house internal audit function obtains the assistance of a 
contractor who can supplement existing internal resources enhances the effectiveness of 
the in-house internal audit team. A truly independent audit function is one of the 
taxpayers' greatest resources in terms of fostering internal controls, assessing the control 
environment, and enhancing accountability and transparency in government. Internal 
auditing is serious business which should not be thwarted by management either directly 
or indirectly through the Board Audit Committee. If the BOCS feels a responsibility to 
the taxpayers to support a truly independent in-house internal audit function, it should not 
approve a plan for the contractor to lead or replace the Audit Services Department. 

This issue should not be one that is used to appear to be decisive by making a quick 
judgment. It requires following a sound model of good judgment that includes careful 
consideration of problems and objectives, gathering and evaluating relevant information 
including full consideration of the pros and cons of alternatives and how each would 
fulfill critical objectives, and careful and reasoned conclusions including the rationale for 
those conclusions. 

The Audit Services Department continues to endorse the original plan as specified in the 
Department of Finance's RFP that was published on April 25, 2012 with the approval of 
management whereby the Audit Services Department would serve as contract 
administrator and would oversee and approve the work of the contractor in the 
performance of selected audits as a way of addressing independence concerns. This 
approach is consistent with the Chairman's statements during the July 24, 2012 BOCS 
meeting where he indicated that County's in-house internal auditors are needed as well as 
contract personnel with specialty area expertise, such as forensic IT audits, who are 
retained as needed but would not be hired on a permanent basis. This approach is also 
consistent with the comments by the County Executive at that same July 2012 BOCS 
meeting. We concur with that model as the Chairman described it in July, which does not 
involve a contractor leading or replacing the in-house Audit Services Department. 
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